This advisory covers two security issues in Grafana as packaged for Red Hat Enterprise Linux 8.8. CVE-2025-22871 is a request smuggling vulnerability in the net/http package caused by acceptance of invalid chunked data, which could allow an attacker to interfere with HTTP request processing. CVE-2025-4123 is a cross-site scripting (XSS) vulnerability in Grafana that arises through custom frontend plugins and an open redirect flaw, potentially enabling script injection attacks. Red Hat has released updated Grafana packages (version 7.5.15-7.el8_8) that address these vulnerabilities. The advisory references Red Hat's official errata RHSA-2025:8685 and provides links for applying the update.

Successful exploitation of CVE-2025-22871 could allow an attacker to perform HTTP request smuggling attacks, potentially interfering with web request handling. CVE-2025-4123 could enable cross-site scripting attacks via malicious custom frontend plugins or open redirect vectors in Grafana, potentially leading to script execution in the context of the victim's browser. Both vulnerabilities are rated as important/high severity by Red Hat. No known active exploits have been reported.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 8.8 that fix these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2025:8685 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is not a cloud service, remediation requires applying the vendor-provided patches. There are no indications that additional mitigations or workarounds are required beyond applying the update.